62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
Size

827KB
MD5

e530ec12a5de0845d3c8675001c53451
SHA1

8c2199fe9ef8e852e9b01678b085ad6d33e3b949
SHA256

62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd
SHA512

8821d01340199ba81eecff1475322cfad31a270028e0cf91e87fb85a7391f91b31d7e5cc464b9127384407b0f80da409f7901b7941d59f457e4a7f09faebfeb2
SSDEEP

24576:KeQsZHFF05EM4dmv5Xf+hPEM4dmv5y53QA:EkFF05j425Xf+hPj42563QA

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2096	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Loads dropped DLL 1 IoCs

pid	Process
388	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2096	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
388	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2096	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2096	388	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe	31
PID 388 wrote to memory of 2096	388	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe	31
PID 388 wrote to memory of 2096	388	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe	31
PID 388 wrote to memory of 2096	388	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe	31

C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
"C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
  C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of UnmapMainImage
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Filesize
827KB

MD5
703bb062e621207f80ab9688b9c120dd

SHA1
347d27ed5b3702fe788ed08597ba811cc36b8cf8

SHA256
0113a6ed32ba8db9b165fcc704f4e472ae775eb171411a627c72b683d86055c3

SHA512
87dc3c94be3e6842682dc1180963155298548551a598932c2424b046ba765ea208fc8d9e3153ead58aa1d223f68359abc5ab3d1857e36bf84122e172e4a3c550

Download Submit
memory/388-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/388-6-0x0000000000130000-0x000000000016C000-memory.dmp

Filesize
240KB

Download
memory/388-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2096-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2096-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2096-17-0x0000000000130000-0x000000000016C000-memory.dmp

Filesize
240KB

Download